CWE-125 · Out-of-bounds Read (page 4)
Page 4 of 94 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55027 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55023 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-54126 | Medium | 6.5 | 2026-07-14 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50682 | High | 7.1 | 2026-07-14 | Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network. |
CVE-2026-50670 | High | 8.8 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50665 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-50498 | High | 7.8 | 2026-07-14 | Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability |
CVE-2026-50496 | High | 7.5 | 2026-07-14 | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50491 | High | 7.0 | 2026-07-14 | Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50470 | High | 7.5 | 2026-07-14 | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50463 | High | 7.5 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50453 | Medium | 6.1 | 2026-07-14 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2026-50437 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-50429 | High | 8.2 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50428 | High | 7.1 | 2026-07-14 | Out-of-bounds read in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally. |
CVE-2026-50422 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-50420 | Medium | 6.2 | 2026-07-14 | Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally. |
CVE-2026-50408 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-50401 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally. |
CVE-2026-50399 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50388 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2026-50377 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-49177 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally. |
CVE-2026-47969 | Medium | 5.5 | 2026-07-14 | Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to… |
CVE-2026-58614 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an authorized attacker to bypass a security feature locally. |
CVE-2026-58609 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. |
CVE-2026-57979 | Medium | 6.5 | 2026-07-14 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-56193 | High | 7.1 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-54996 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-54991 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-54988 | Medium | 6.1 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-54111 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-54058 | Critical | 9.1 | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attac… |
CVE-2026-50300 | Medium | 5.5 | 2026-07-14 | Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-49794 | Medium | 4.6 | 2026-07-14 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2026-60082 | Critical | 9.1 | 2026-07-14 | DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was no… |
CVE-2026-59198 | Medium | 6.5 | 2026-07-14 | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE… |
CVE-2025-53379 | High | 7.5 | 2026-07-14 | A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated a… |
CVE-2026-10672 | High | 8.2 | 2026-07-14 | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_… |
CVE-2026-53566 | | 2026-07-14 | Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: before 26.6.1… | |
CVE-2026-12478 | Medium | 4.8 | 2026-07-14 | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client fra… |
CVE-2026-58102 | Critical | 9.1 | 2026-07-13 | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extensi… |
CVE-2026-51541 | Critical | 9.1 | 2026-07-13 | OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An att… |
CVE-2026-51537 | Critical | 9.1 | 2026-07-13 | EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malfor… |
CVE-2026-60103 | Medium | 6.1 | 2026-07-13 | Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a c… |
CVE-2026-57432 | High | 8.4 | 2026-07-13 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds eac… |
CVE-2026-57158 | Critical | 9.1 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix fo… |
CVE-2026-57157 | Medium | 6.5 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator c… |
CVE-2026-14461 | | 2026-07-10 | mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigge… | |
CVE-2026-40454 | High | 7.5 | 2026-07-10 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash clie… |
CVE-2026-11404 | High | 7.5 | 2026-07-09 | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled s… |
CVE-2026-15185 | Low | 3.3 | 2026-07-09 | A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Exec… |
CVE-2026-58307 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Esc… |
CVE-2026-58304 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58… |
CVE-2026-15114 | High | 8.8 | 2026-07-08 | Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-29007 | Medium | 5.3 | 2026-07-08 | U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote… |
CVE-2026-56374 | Low | 3.3 | 2026-07-08 | ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote a… |
CVE-2026-56362 | Low | 3.3 | 2026-07-08 | ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before… |
CVE-2026-57258 | Medium | 6.1 | 2026-07-08 | The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underlying array contains elements and reads… |
CVE-2026-57257 | Medium | 6.1 | 2026-07-08 | During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the entity array. As a… |
CVE-2026-57255 | Medium | 6.1 | 2026-07-08 | The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is… |
CVE-2026-57253 | Medium | 6.1 | 2026-07-08 | An abnormal image object causes the renderer to enter the wrong processing branch. When converting the scan lines, an invalid image buffer pointer is used, res… |
CVE-2026-57243 | Medium | 6.1 | 2026-07-08 | During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page in… |
CVE-2026-57241 | Medium | 6.1 | 2026-07-08 | The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose… |
CVE-2026-50811 | Medium | 6.5 | 2026-07-07 | An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in… |
CVE-2026-14740 | Critical | 9.1 | 2026-07-07 | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and remove… |
CVE-2026-58469 | High | 7.5 | 2026-07-07 | GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c… |
CVE-2026-38973 | Medium | 4.4 | 2026-07-06 | mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method(). |
CVE-2026-13705 | High | 7.1 | 2026-07-06 | Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. … |
CVE-2026-10657 | Low | 3.7 | 2026-07-05 | Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name_internal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'), ".local", 7)… |
CVE-2026-14647 | Medium | 4.3 | 2026-07-04 | A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of… |
CVE-2026-53360 | High | 8.8 | 2026-07-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when u… |
CVE-2026-56015 | Critical | 9.1 | 2026-07-03 | Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add() passes the prefix string to the trie builder… |
CVE-2026-38971 | Critical | 9.1 | 2026-07-02 | ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_co… |
CVE-2026-14422 | High | 8.8 | 2026-07-01 | Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2026-14420 | Critical | 9.6 | 2026-07-01 | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT… |
CVE-2026-14416 | Critical | 9.6 | 2026-07-01 | Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (… |
CVE-2026-14406 | Medium | 5.9 | 2026-07-01 | Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension to obtain potentiall… |
CVE-2026-14396 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secu… |
CVE-2026-14388 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-14386 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-14384 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-54908 | | 2026-07-01 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsi… | |
CVE-2025-15646 | Critical | 9.8 | 2026-07-01 | HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, bu… |
CVE-2026-53346 | High | 7.1 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Due to a rustc bug [1]… |
CVE-2026-53330 | High | 7.1 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() [Why & How] The au… |
CVE-2026-44041 | Medium | 4.3 | 2026-07-01 | UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a… |
CVE-2026-54592 | High | 7.5 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively ov… |
CVE-2026-54500 | Medium | 5.3 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized sta… |
CVE-2026-56361 | Low | 3.3 | 2026-06-30 | ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer o… |
CVE-2026-14090 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to perform an out of… |
CVE-2026-14063 | Medium | 5.7 | 2026-06-30 | Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memo… |
CVE-2026-14011 | High | 8.1 | 2026-06-30 | Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HT… |
CVE-2026-13975 | Medium | 5.3 | 2026-06-30 | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potenti… |
CVE-2026-13906 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-13890 | Medium | 5.3 | 2026-06-30 | Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potential… |
CVE-2026-13873 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-13858 | Medium | 6.5 | 2026-06-30 | Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-13820 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-orig… |
CVE-2026-13819 | High | 8.1 | 2026-06-30 | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform an out… |